Segmenting Cloud Networks for High Availability and Security
A Virtual Private Cloud provides an isolated private network within AWS. A subnet is a distinct IP address range carved out from the parent VPC's primary Classless Inter-Domain Routing block. Each subnet maps directly to a single physical Availability Zone. Site Reliability Engineers use subnets to enforce defense-in-depth, minimize blast radiuses, and guarantee high platform availability.
Structural Subnet Classifications and Routing Topologies
Engineers control network behavior by binding custom route tables to individual subnets:
- Public Subnets: The associated route table directs non-local egress traffic to an Internet Gateway. These host ingress load balancers and outward-facing proxies.
- Private Subnets: The route table forwards outbound traffic to a Network Address Translation Gateway located within a public subnet. This setup allows backend compute instances to download external patches without accepting inbound internet requests.
- Isolated Subnets: These lack both Internet Gateway and NAT routes entirely. They host core databases and proprietary data caches, communicating solely with other VPC subnets or private endpoints.
Resiliency and Redundancy Across Availability Zones
Because a subnet cannot span multiple Availability Zones, building reliable services requires deliberate multi-zone architectures:
- Fault Domain Isolation: Physical failures inside a single data center stay confined to that specific zone.
- High Availability Pairs: Production workloads deploy across at least two private subnets mapped to distinct zones.
- Traffic Balancing: Application Load Balancers split incoming user requests across these separate subnets automatically.
- Automated Failover: If an Availability Zone experiences hardware disruption, healthy compute nodes in the paired subnet maintain service continuity.
Network Defense and Traffic Segmentation
Subnets act as primary security boundaries to prevent unauthorized lateral movement across cloud environments:
- Network Access Control Lists: SREs configure stateless packet filters at the subnet boundary to block suspicious CIDRs before packets reach running instances.
- Tiered Demarcation: Strict subnet separation prevents a compromised web layer from gaining unfettered network access to transactional databases.
- VPC Interface Endpoints: Internal systems query AWS managed services through private IPs inside the subnet, avoiding any transit over the public internet.
- Address Space Planning: AWS reserves five IP addresses per subnet for networking operations, making careful sizing essential to prevent IP exhaustion during auto-scaling events.